@empire-builder-kit/nx 1.0.0-rc.2 → 1.0.0-rc.21

package/src/infrastructure-change/local-capability.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOCAL_MUTATION_CAPABILITY_LIFETIME_MS = void 0;
+exports.localMutationAuthorityEnvelope = localMutationAuthorityEnvelope;
+exports.createLocalMutationCapability = createLocalMutationCapability;
+exports.computeLocalMutationAuthorityDigest = computeLocalMutationAuthorityDigest;
+exports.validateLocalMutationCapability = validateLocalMutationCapability;
+const canonical_json_1 = require("@empire-builder-kit/runtime/canonical-json");
+const SHA = /^[a-f0-9]{40}$/;
+const SHA256 = /^[a-f0-9]{64}$/;
+const ROLE = /^arn:(aws|aws-us-gov|aws-cn):iam::\d{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/;
+const ACTOR = /^arn:(aws|aws-us-gov|aws-cn):sts::\d{12}:assumed-role\/[A-Za-z0-9+=,.@_-]{1,128}\/[A-Za-z0-9+=,.@_-]{1,128}$/;
+exports.LOCAL_MUTATION_CAPABILITY_LIFETIME_MS = 10 * 60_000;
+function sha256(value) {
+    return (0, canonical_json_1.canonicalJsonSha256)(value, { omitUndefinedObjectValues: true });
+}
+function localMutationAuthorityEnvelope(input) {
+    const { plan } = input;
+    const planAuthorityPolicyDigest = plan.versions['plan-authority-policy'];
+    if ((plan.action !== 'deploy' && plan.action !== 'refresh') ||
+        plan.projects.length !== 1 ||
+        plan.projects[0] !== input.project ||
+        !input.project ||
+        !ACTOR.test(input.actorArn) ||
+        !SHA.test(plan.sourceCommit) ||
+        !SHA.test(input.deploymentSourceCommit) ||
+        !SHA.test(input.deploymentSourceTree) ||
+        !SHA.test(input.releaseSourceTree) ||
+        !ROLE.test(input.expectedRoleArn) ||
+        !SHA256.test(plan.materialDigest) ||
+        !SHA256.test(plan.configurationMetadataDigest) ||
+        !SHA256.test(plan.policyProfileDigest) ||
+        !SHA256.test(plan.state.digest) ||
+        plan.state.locked !== false ||
+        !planAuthorityPolicyDigest ||
+        !SHA256.test(planAuthorityPolicyDigest)) {
+        throw new Error('Local mutation authority requires one exact source, project, policy, artifact, role, and state envelope.');
+    }
+    if (plan.target.stage !== 'development' &&
+        plan.target.stage !== 'staging' &&
+        plan.target.stage !== 'production') {
+        throw new Error('Local mutation authority requires one canonical stage.');
+    }
+    return {
+        accountFingerprint: plan.target.accountFingerprint,
+        action: plan.action,
+        actorArnDigest: sha256(input.actorArn),
+        configurationMetadataDigest: plan.configurationMetadataDigest,
+        deploymentSourceCommit: input.deploymentSourceCommit,
+        deploymentSourceTree: input.deploymentSourceTree,
+        deploymentProfile: input.deploymentProfile,
+        expectedRoleArnDigest: sha256(input.expectedRoleArn),
+        frameworkVersion: plan.frameworkVersion,
+        planAuthorityPolicyDigest,
+        planMaterialDigest: plan.materialDigest,
+        policyProfileDigest: plan.policyProfileDigest,
+        project: input.project,
+        region: plan.target.region,
+        releaseSourceCommit: plan.sourceCommit,
+        releaseSourceTree: input.releaseSourceTree,
+        stage: plan.target.stage,
+        state: {
+            backend: plan.state.backend,
+            digest: plan.state.digest,
+            locked: false,
+            stack: plan.state.stack,
+            version: plan.state.version,
+        },
+        versions: { ...plan.versions },
+    };
+}
+function createLocalMutationCapability(input) {
+    if (!input.nonce || input.nonce.length < 32) {
+        throw new Error('Local mutation capability nonce is absent or too short.');
+    }
+    const authority = localMutationAuthorityEnvelope(input);
+    const issuedAt = input.issuedAt.toISOString();
+    const expiresAt = new Date(input.issuedAt.getTime() + exports.LOCAL_MUTATION_CAPABILITY_LIFETIME_MS).toISOString();
+    return {
+        authority,
+        authorityDigest: sha256(authority),
+        authorizationDigest: sha256(input.authorizationContents),
+        expiresAt,
+        issuedAt,
+        kind: 'ebk-local-mutation-capability',
+        nonceDigest: sha256(input.nonce),
+        planEvidenceDigest: sha256(input.planContents),
+        schemaVersion: 1,
+    };
+}
+function computeLocalMutationAuthorityDigest(authority) {
+    return sha256(authority);
+}
+function validateLocalMutationCapability(input) {
+    const issuedAt = Date.parse(input.capability.issuedAt);
+    const expiresAt = Date.parse(input.capability.expiresAt);
+    const now = input.now.getTime();
+    if (input.capability.kind !== 'ebk-local-mutation-capability' ||
+        input.capability.schemaVersion !== 1 ||
+        !Number.isFinite(issuedAt) ||
+        !Number.isFinite(expiresAt) ||
+        issuedAt > now ||
+        expiresAt <= now ||
+        expiresAt - issuedAt !== exports.LOCAL_MUTATION_CAPABILITY_LIFETIME_MS ||
+        input.capability.nonceDigest !== sha256(input.nonce) ||
+        input.capability.planEvidenceDigest !== sha256(input.planContents) ||
+        input.capability.authorizationDigest !==
+            sha256(input.authorizationContents) ||
+        input.capability.authorityDigest !== sha256(input.capability.authority) ||
+        input.capability.authorityDigest !== sha256(input.expectedAuthority)) {
+        throw new Error('Local mutation capability is malformed, expired, replayed, or no longer bound to retained evidence.');
+    }
+}
+//# sourceMappingURL=local-capability.js.map

package/src/infrastructure-change/local-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-capability.js","sourceRoot":"","sources":["../../../../../packages/nx/src/infrastructure-change/local-capability.ts"],"names":[],"mappings":";;;AA2DA,wEAqEC;AAED,sEAiCC;AAED,kFAIC;AAED,0EA8BC;AAzMD,+EAAiF;AAOjF,MAAM,GAAG,GAAG,gBAAgB,CAAC;AAC7B,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,IAAI,GACR,4EAA4E,CAAC;AAC/E,MAAM,KAAK,GACT,8GAA8G,CAAC;AACpG,QAAA,qCAAqC,GAAG,EAAE,GAAG,MAAM,CAAC;AA0CjE,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,IAAA,oCAAmB,EAAC,KAAK,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,SAAgB,8BAA8B,CAAC,KAS9C;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,MAAM,yBAAyB,GAAG,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IACzE,IACE,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO;QAClC,CAAC,KAAK,CAAC,OAAO;QACd,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC3B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;QAC5B,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC;QACvC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC;QACrC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAClC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;QACjC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;QACjC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC;QAC9C,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;QACtC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK;QAC3B,CAAC,yBAAyB;QAC1B,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,EACvC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,aAAa;QACnC,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;QAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY,EAClC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO;QACL,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;QAClD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QACtC,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;QAC7D,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;QACpD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,yBAAyB;QACzB,kBAAkB,EAAE,IAAI,CAAC,cAAc;QACvC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;QAC1B,mBAAmB,EAAE,IAAI,CAAC,YAAY;QACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;QACxB,KAAK,EAAE;YACL,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;YAC3B,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;YACzB,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;YACvB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;SAC5B;QACD,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE;KAC/B,CAAC;AACJ,CAAC;AAED,SAAgB,6BAA6B,CAAC,KAa7C;IACC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,SAAS,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,6CAAqC,CACjE,CAAC,WAAW,EAAE,CAAC;IAChB,OAAO;QACL,SAAS;QACT,eAAe,EAAE,MAAM,CAAC,SAAS,CAAC;QAClC,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC;QACxD,SAAS;QACT,QAAQ;QACR,IAAI,EAAE,+BAA+B;QACrC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QAChC,kBAAkB,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;QAC9C,aAAa,EAAE,CAAC;KACjB,CAAC;AACJ,CAAC;AAED,SAAgB,mCAAmC,CACjD,SAA2C;IAE3C,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;AAC3B,CAAC;AAED,SAAgB,+BAA+B,CAAC,KAO/C;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAChC,IACE,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,+BAA+B;QACzD,KAAK,CAAC,UAAU,CAAC,aAAa,KAAK,CAAC;QACpC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC1B,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,QAAQ,GAAG,GAAG;QACd,SAAS,IAAI,GAAG;QAChB,SAAS,GAAG,QAAQ,KAAK,6CAAqC;QAC9D,KAAK,CAAC,UAAU,CAAC,WAAW,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QACpD,KAAK,CAAC,UAAU,CAAC,kBAAkB,KAAK,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;QAClE,KAAK,CAAC,UAAU,CAAC,mBAAmB;YAClC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC;QACrC,KAAK,CAAC,UAAU,CAAC,eAAe,KAAK,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QACvE,KAAK,CAAC,UAAU,CAAC,eAAe,KAAK,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EACpE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/src/infrastructure-change/model.d.ts

@@ -2,7 +2,7 @@ export declare const INFRASTRUCTURE_CHANGE_SCHEMA_VERSION: 1;
 export declare const INFRASTRUCTURE_PLAN_KIND: "ebk-infrastructure-plan";
 export declare const SST_DIFF_TOOL_NAME: "sst";
 export declare const SST_DIFF_TOOL_VERSION: "4.17.1";
-export declare const INFRASTRUCTURE_OPERATIONS: readonly ["create", "update", "replace", "delete", "import", "read", "unknown"];
+export declare const INFRASTRUCTURE_OPERATIONS: readonly ["create", "update", "replace", "delete", "discard", "import", "read", "unknown"];
 export type InfrastructureOperation = (typeof INFRASTRUCTURE_OPERATIONS)[number];
 export declare const INFRASTRUCTURE_RISK_CLASSES: readonly ["no-change", "additive-low-risk", "in-place-reviewed", "stateless-replacement", "stateful-or-destructive", "security-expansion", "protection-reduction", "material-cost-or-quota", "unknown"];
 export type InfrastructureRiskClass = (typeof INFRASTRUCTURE_RISK_CLASSES)[number];
@@ -76,11 +76,23 @@ export interface IamAccessAnalyzerValidationV1 {
     status: 'complete' | 'failed' | 'unsupported';
 }
 export interface InfrastructureRiskPolicyV1 {
+    /**
+     * Exact provider imports whose ownership transition is already bound to a
+     * committed authority, deterministic private identifier, retain behavior,
+     * and recovery runbook. Every other import remains blocked.
+     */
+    adoptedImports: readonly AdoptedInfrastructureImportV1[];
     /**
      * Exact provider types whose create operation has been reviewed as a
      * private, stateless, low-cost addition.
      */
     additiveLowRiskTypes: readonly string[];
+    /**
+     * Exact provider types whose create operation is expected but still
+     * requires a digest-bound deployment review. Undeclared additions remain
+     * unknown and fail closed.
+     */
+    additiveReviewedTypes: readonly string[];
     /**
      * Exact provider types that can materially change cost or consume quotas.
      */
@@ -91,6 +103,14 @@ export interface InfrastructureRiskPolicyV1 {
      */
     statefulTypes: readonly string[];
 }
+export interface AdoptedInfrastructureImportV1 {
+    authority: 'workload-role-account-baseline';
+    logicalId: string;
+    privateIdentifierTemplate: string;
+    recoveryRunbookRef: string;
+    removalBehavior: 'retain';
+    resourceType: string;
+}
 export type InfrastructureDriftStatus = 'not-checked' | 'no-drift' | 'drift-detected' | 'partial-coverage' | 'unsupported' | 'failed';
 export type InfrastructureMutationAction = 'deploy' | 'refresh' | 'remove';
 export interface InfrastructurePlanTargetV1 {
@@ -145,11 +165,11 @@ export interface InfrastructureApprovalRecordV1 {
     evidenceRefs: Readonly<Record<string, string>>;
     expiresAt: string;
     materialDigest: string;
-    mode: 'standing-policy' | 'human-record' | 'environment-reviewer';
+    mode: 'standing-policy' | 'human-record' | 'environment-reviewer' | 'operator-acknowledgement';
     recordPath?: string;
     stage: string;
 }
-export type InfrastructurePlanValidationCode = 'approval-invalid' | 'approval-missing' | 'diff-incomplete' | 'drift-unresolved' | 'material-plan-changed' | 'plan-expired' | 'plan-schema-invalid' | 'plan-tool-version-invalid' | 'source-change-invalid' | 'state-lock-unverified' | 'state-locked' | 'unknown-risk';
+export type InfrastructurePlanValidationCode = 'approval-invalid' | 'approval-missing' | 'authority-envelope-changed' | 'approval-required-change' | 'diff-incomplete' | 'drift-unresolved' | 'material-plan-changed' | 'plan-expired' | 'plan-schema-invalid' | 'plan-tool-version-invalid' | 'source-change-invalid' | 'state-lock-unverified' | 'state-locked' | 'unknown-risk';
 export interface InfrastructurePlanValidationFindingV1 {
     code: InfrastructurePlanValidationCode;
     detail: string;
@@ -164,6 +184,7 @@ export interface InfrastructureAuthorizationEvidenceV1 {
     approval?: InfrastructureApprovalRecordV1;
     governanceEvidenceDigests?: Readonly<Record<string, string>>;
     kind: 'ebk-infrastructure-authorization';
+    localGovernance?: unknown;
     plannedMaterialDigest: string;
     recomputedMaterialDigest: string;
     schemaVersion: typeof INFRASTRUCTURE_CHANGE_SCHEMA_VERSION;
@@ -245,7 +266,7 @@ export interface PostPlanExplanationV1 {
     resourceId: string;
     ownershipRuleRef: string;
 }
-export type InfrastructureOperationOutcome = 'apply-complete-unverified' | 'apply-failed-no-change' | 'apply-partial' | 'cleanup-incomplete' | 'converged' | 'recovery-required';
+export type InfrastructureOperationOutcome = 'apply-complete-unverified' | 'refresh-complete-replan-required' | 'apply-failed-no-change' | 'apply-partial' | 'cleanup-incomplete' | 'converged' | 'recovery-required';
 export interface InfrastructureConvergenceV1 {
     converged: boolean;
     findings: readonly string[];

package/src/infrastructure-change/model.js

@@ -10,6 +10,7 @@ exports.INFRASTRUCTURE_OPERATIONS = [
     'update',
     'replace',
     'delete',
+    'discard',
     'import',
     'read',
     'unknown',

package/src/infrastructure-change/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../../../packages/nx/src/infrastructure-change/model.ts"],"names":[],"mappings":";;;AAAa,QAAA,oCAAoC,GAAG,CAAU,CAAC;AAClD,QAAA,wBAAwB,GAAG,yBAAkC,CAAC;AAC9D,QAAA,kBAAkB,GAAG,KAAc,CAAC;AACpC,QAAA,qBAAqB,GAAG,QAAiB,CAAC;AAE1C,QAAA,yBAAyB,GAAG;IACvC,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,SAAS;CACD,CAAC;AAKE,QAAA,2BAA2B,GAAG;IACzC,WAAW;IACX,mBAAmB;IACnB,mBAAmB;IACnB,uBAAuB;IACvB,yBAAyB;IACzB,oBAAoB;IACpB,sBAAsB;IACtB,wBAAwB;IACxB,SAAS;CACD,CAAC"}
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../../../packages/nx/src/infrastructure-change/model.ts"],"names":[],"mappings":";;;AAAa,QAAA,oCAAoC,GAAG,CAAU,CAAC;AAClD,QAAA,wBAAwB,GAAG,yBAAkC,CAAC;AAC9D,QAAA,kBAAkB,GAAG,KAAc,CAAC;AACpC,QAAA,qBAAqB,GAAG,QAAiB,CAAC;AAE1C,QAAA,yBAAyB,GAAG;IACvC,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,MAAM;IACN,SAAS;CACD,CAAC;AAKE,QAAA,2BAA2B,GAAG;IACzC,WAAW;IACX,mBAAmB;IACnB,mBAAmB;IACnB,uBAAuB;IACvB,yBAAyB;IACzB,oBAAoB;IACpB,sBAAsB;IACtB,wBAAwB;IACxB,SAAS;CACD,CAAC"}

package/src/infrastructure-change/normalize.d.ts

@@ -6,7 +6,11 @@ import { type NormalizedSstDiffV1 } from './model.js';
  * intentionally discarded so values cannot enter an EBK report.
  */
 export declare function normalizeSstDiffV4_17_1(input: {
+    errorCode?: string | null;
     exitCode: number;
+    signal?: string | null;
+    spawnError?: boolean;
+    stderr?: string;
     stdout: string | unknown;
     toolVersion: string;
 }): NormalizedSstDiffV1;

package/src/infrastructure-change/normalize.js

@@ -32,6 +32,7 @@ const PROPERTY_DIFF_KINDS = new Set([
 const REPLACEMENT_OPERATIONS = new Set([
     'create-replacement',
     'delete-replaced',
+    'discard-replaced',
     'import-replacement',
     'read-replacement',
     'replace',
@@ -75,9 +76,12 @@ function normalizeOperation(providerOperation) {
             return 'update';
         case 'delete':
             return 'delete';
+        case 'discard':
+            return 'discard';
         case 'replace':
         case 'create-replacement':
         case 'delete-replaced':
+        case 'discard-replaced':
         case 'read-replacement':
         case 'import-replacement':
             return 'replace';
@@ -89,6 +93,34 @@ function normalizeOperation(providerOperation) {
             return 'unknown';
     }
 }
+function compareNormalizedResources(left, right) {
+    return ((0, deterministic_order_js_1.compareUtf16)(left.logicalId, right.logicalId) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.resourceType, right.resourceType) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.operation, right.operation) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.providerOperation, right.providerOperation) ||
+        Number(left.replacement) - Number(right.replacement) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.replacementStrategy, right.replacementStrategy) ||
+        (0, deterministic_order_js_1.compareUtf16)(JSON.stringify(left.changedProperties), JSON.stringify(right.changedProperties)) ||
+        left.sourceIndex - right.sourceIndex);
+}
+function externalResourceLogicalId(entry, providerOperation, resourceType) {
+    const state = providerOperation === 'discard' || providerOperation === 'discard-replaced'
+        ? entry['old']
+        : providerOperation === 'read' || providerOperation === 'read-replacement'
+            ? entry['new']
+            : undefined;
+    if (!isRecord(state))
+        return undefined;
+    const id = state['id'];
+    if (typeof id !== 'string' || id.length === 0)
+        return undefined;
+    return `external-${(0, node_crypto_1.createHash)('sha256')
+        .update(resourceType)
+        .update('\0')
+        .update(id)
+        .digest('hex')
+        .slice(0, 24)}`;
+}
 function normalizeProperty(path, raw) {
     if (!isRecord(raw)) {
         return undefined;
@@ -138,9 +170,6 @@ function normalizeSstDiffV4_17_1(input) {
         raw = [];
     }
     const entries = Array.isArray(raw) ? raw : [];
-    if (!Number.isSafeInteger(input.exitCode) || input.exitCode !== 0) {
-        failures.push(failure('diff-command-failed', 'SST diff did not complete with exit code zero'));
-    }
     const resources = [];
     for (const [sourceIndex, entry] of entries.entries()) {
         if (!isRecord(entry)) {
@@ -188,15 +217,25 @@ function normalizeSstDiffV4_17_1(input) {
             }
         }
         const keys = entry['keys'];
+        if (keys !== undefined &&
+            keys !== null &&
+            (!Array.isArray(keys) || !keys.every((key) => typeof key === 'string'))) {
+            failures.push(failure('diff-shape-invalid', 'replacement keys must be an array of strings when present', sourceIndex));
+        }
         const hasReplacementKeys = Array.isArray(keys) &&
             keys.length > 0 &&
             keys.every((key) => typeof key === 'string');
         const replacement = REPLACEMENT_OPERATIONS.has(providerOperation) ||
             hasReplacementKeys ||
             changedProperties.some((property) => property.kind.endsWith('-replace'));
+        const externalLogicalId = externalResourceLogicalId(entry, providerOperation, resourceType);
+        if (['discard', 'discard-replaced', 'read', 'read-replacement'].includes(providerOperation) &&
+            externalLogicalId === undefined) {
+            failures.push(failure('diff-shape-invalid', 'external resource operations require one exact physical identifier', sourceIndex));
+        }
         resources.push({
             changedProperties,
-            logicalId: logicalResourceId(urn),
+            logicalId: externalLogicalId ?? logicalResourceId(urn),
             operation: normalizeOperation(providerOperation),
             providerOperation,
             replacement,
@@ -225,14 +264,15 @@ function normalizeSstDiffV4_17_1(input) {
                     : 'delete-before-create';
         }
     }
+    if (!Number.isSafeInteger(input.exitCode) || input.exitCode !== 0) {
+        failures.push(failure('diff-command-failed', 'SST diff did not produce an authorized complete command outcome'));
+    }
     return {
         complete: failures.length === 0,
         diagnosticCoverage: 'exit-status-only',
         failures,
         kind: 'ebk-sst-diff',
-        resources: resources.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.logicalId, right.logicalId) ||
-            (0, deterministic_order_js_1.compareUtf16)(left.resourceType, right.resourceType) ||
-            left.sourceIndex - right.sourceIndex),
+        resources: resources.sort(compareNormalizedResources),
         schemaVersion: model_js_1.INFRASTRUCTURE_CHANGE_SCHEMA_VERSION,
         sourceBoundary: 'desired-source-vs-recorded-state',
         stateIdentityCoverage: 'not-emitted-by-diff-json',

package/src/infrastructure-change/normalize.js.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../../../../packages/nx/src/infrastructure-change/normalize.ts"],"names":[],"mappings":";;AAqJA,0DAsMC;AA3VD,sEAAyD;AACzD,6CAAyC;AACzC,yCASoB;AAEpB,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,QAAQ;IACR,oBAAoB;IACpB,QAAQ;IACR,iBAAiB;IACjB,SAAS;IACT,kBAAkB;IAClB,QAAQ;IACR,oBAAoB;IACpB,MAAM;IACN,kBAAkB;IAClB,SAAS;IACT,wBAAwB;IACxB,SAAS;IACT,MAAM;IACN,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK;IACL,aAAa;IACb,QAAQ;IACR,gBAAgB;IAChB,QAAQ;IACR,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,oBAAoB;IACpB,iBAAiB;IACjB,oBAAoB;IACpB,kBAAkB;IAClB,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,eAAe;IACf,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,SAAS;IACT,OAAO;IACP,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,YAAY,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAI;SACf,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,KAAK,CAAC,YAAY,CAAC;SACnB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CACL,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrD,4DAA4D,CAAC,IAAI,CAAC,MAAM,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,iBAAyB;IAEzB,QAAQ,iBAAiB,EAAE,CAAC;QAC1B,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,SAAS,CAAC;QACf,KAAK,oBAAoB,CAAC;QAC1B,KAAK,iBAAiB,CAAC;QACvB,KAAK,kBAAkB,CAAC;QACxB,KAAK,oBAAoB;YACvB,OAAO,SAAS,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAY,EACZ,GAAY;IAEZ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO;QACL,SAAS,EAAE,SAAS,KAAK,IAAI;QAC7B,IAAI,EACF,OAAO,QAAQ,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC/D,CAAC,CAAE,QAAoD;YACvD,CAAC,CAAC,SAAS;QACf,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;QACrC,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,IAA8B,EAC9B,MAAc,EACd,WAAoB;IAEpB,OAAO;QACL,IAAI;QACJ,MAAM;QACN,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,KAIvC;IACC,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,IAAI,GAAG,GAAY,KAAK,CAAC,MAAM,CAAC;IAChC,IAAI,KAAK,CAAC,WAAW,KAAK,gCAAqB,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,4BAA4B,EAC5B,gBAAgB,gCAAqB,mCAAmC,CACzE,CACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CACjE,CAAC;YACF,GAAG,GAAG,EAAE,CAAC;QACX,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,oBAAoB,EAAE,gCAAgC,CAAC,CAChE,CAAC;QACF,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,OAAO,GAAuB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,qBAAqB,EACrB,+CAA+C,CAChD,CACF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAyC,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,qCAAqC,EACrC,WAAW,CACZ,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IACE,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,CAAC,MAAM,KAAK,CAAC;YAChB,OAAO,YAAY,KAAK,QAAQ;YAChC,YAAY,CAAC,MAAM,KAAK,CAAC;YACzB,OAAO,iBAAiB,KAAK,QAAQ,EACrC,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,4DAA4D,EAC5D,WAAW,CACZ,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IACE,CAAC,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAC3C,iBAAiB,KAAK,MAAM;YAC5B,kBAAkB,CAAC,iBAAiB,CAAC,KAAK,SAAS,EACnD,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,wBAAwB,EACxB,8DAA8D,EAC9D,WAAW,CACZ,CACF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QAC3C,MAAM,iBAAiB,GAAsC,EAAE,CAAC;QAChE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,wCAAwC,EACxC,WAAW,CACZ,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CACjE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,EAAE,KAAK,CAAC,CAC/C,EAAE,CAAC;oBACF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;oBACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAC3B,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,qCAAqC,EACrC,WAAW,CACZ,CACF,CAAC;wBACF,SAAS;oBACX,CAAC;oBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBAChC,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,mDAAmD,EACnD,WAAW,CACZ,CACF,CAAC;oBACJ,CAAC;oBACD,IACE,CAAC,QAAQ,CAAC,WAAW,CAAC;wBACtB,OAAO,WAAW,CAAC,WAAW,CAAC,KAAK,SAAS,EAC7C,CAAC;wBACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,sCAAsC,EACtC,WAAW,CACZ,CACF,CAAC;oBACJ,CAAC;oBACD,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,kBAAkB,GACtB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,IAAI,CAAC,MAAM,GAAG,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC;QAC/C,MAAM,WAAW,GACf,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAC7C,kBAAkB;YAClB,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3E,SAAS,CAAC,IAAI,CAAC;YACb,iBAAiB;YACjB,SAAS,EAAE,iBAAiB,CAAC,GAAG,CAAC;YACjC,SAAS,EAAE,kBAAkB,CAAC,iBAAiB,CAAC;YAChD,iBAAiB;YACjB,WAAW;YACX,mBAAmB,EAAE,SAAS;YAC9B,YAAY;YACZ,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IACD,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,SAAS,SAAS,QAAQ,CAAC,YAAY,EAAE,CAAC;QAClE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAC1C,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,WAAW;YAAE,SAAS;QACpC,MAAM,QAAQ,GACZ,oBAAoB,CAAC,GAAG,CACtB,GAAG,QAAQ,CAAC,SAAS,SAAS,QAAQ,CAAC,YAAY,EAAE,CACtD,IAAI,EAAE,CAAC;QACV,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACxD,IAAI,WAAW,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,mBAAmB;gBAC1B,WAAW,GAAG,WAAW;oBACvB,CAAC,CAAC,sBAAsB;oBACxB,CAAC,CAAC,sBAAsB,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC/B,kBAAkB,EAAE,kBAAkB;QACtC,QAAQ;QACR,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,SAAS,CAAC,IAAI,CACvB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAA,qCAAY,EAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;YAC7C,IAAA,qCAAY,EAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC;YACnD,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CACvC;QACD,aAAa,EAAE,+CAAoC;QACnD,cAAc,EAAE,kCAAkC;QAClD,qBAAqB,EAAE,0BAA0B;QACjD,IAAI,EAAE;YACJ,IAAI,EAAE,6BAAkB;YACxB,OAAO,EAAE,gCAAqB;SAC/B;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../../../../packages/nx/src/infrastructure-change/normalize.ts"],"names":[],"mappings":";;AAkMA,0DAqOC;AAvaD,sEAAyD;AACzD,6CAAyC;AACzC,yCASoB;AAEpB,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,QAAQ;IACR,oBAAoB;IACpB,QAAQ;IACR,iBAAiB;IACjB,SAAS;IACT,kBAAkB;IAClB,QAAQ;IACR,oBAAoB;IACpB,MAAM;IACN,kBAAkB;IAClB,SAAS;IACT,wBAAwB;IACxB,SAAS;IACT,MAAM;IACN,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK;IACL,aAAa;IACb,QAAQ;IACR,gBAAgB;IAChB,QAAQ;IACR,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,kBAAkB;IAClB,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,eAAe;IACf,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,SAAS;IACT,OAAO;IACP,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,YAAY,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAI;SACf,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,KAAK,CAAC,YAAY,CAAC;SACnB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CACL,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrD,4DAA4D,CAAC,IAAI,CAAC,MAAM,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,iBAAyB;IAEzB,QAAQ,iBAAiB,EAAE,CAAC;QAC1B,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,SAAS,CAAC;QACf,KAAK,oBAAoB,CAAC;QAC1B,KAAK,iBAAiB,CAAC;QACvB,KAAK,kBAAkB,CAAC;QACxB,KAAK,kBAAkB,CAAC;QACxB,KAAK,oBAAoB;YACvB,OAAO,SAAS,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,IAAwC,EACxC,KAAyC;IAEzC,OAAO,CACL,IAAA,qCAAY,EAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;QAC7C,IAAA,qCAAY,EAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC;QACnD,IAAA,qCAAY,EAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;QAC7C,IAAA,qCAAY,EAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QACpD,IAAA,qCAAY,EAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,CAAC;QACjE,IAAA,qCAAY,EACV,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,EACtC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,CACxC;QACD,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,KAA8B,EAC9B,iBAAyB,EACzB,YAAoB;IAEpB,MAAM,KAAK,GACT,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,KAAK,kBAAkB;QACzE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;QACd,CAAC,CAAC,iBAAiB,KAAK,MAAM,IAAI,iBAAiB,KAAK,kBAAkB;YACxE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;YACd,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,YAAY,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACpC,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,EAAE,CAAC;SACV,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAY,EACZ,GAAY;IAEZ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO;QACL,SAAS,EAAE,SAAS,KAAK,IAAI;QAC7B,IAAI,EACF,OAAO,QAAQ,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC/D,CAAC,CAAE,QAAoD;YACvD,CAAC,CAAC,SAAS;QACf,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;QACrC,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,IAA8B,EAC9B,MAAc,EACd,WAAoB;IAEpB,OAAO;QACL,IAAI;QACJ,MAAM;QACN,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,KAQvC;IACC,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,IAAI,GAAG,GAAY,KAAK,CAAC,MAAM,CAAC;IAChC,IAAI,KAAK,CAAC,WAAW,KAAK,gCAAqB,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,4BAA4B,EAC5B,gBAAgB,gCAAqB,mCAAmC,CACzE,CACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CACjE,CAAC;YACF,GAAG,GAAG,EAAE,CAAC;QACX,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,oBAAoB,EAAE,gCAAgC,CAAC,CAChE,CAAC;QACF,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,OAAO,GAAuB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,SAAS,GAAyC,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,qCAAqC,EACrC,WAAW,CACZ,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IACE,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,CAAC,MAAM,KAAK,CAAC;YAChB,OAAO,YAAY,KAAK,QAAQ;YAChC,YAAY,CAAC,MAAM,KAAK,CAAC;YACzB,OAAO,iBAAiB,KAAK,QAAQ,EACrC,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,4DAA4D,EAC5D,WAAW,CACZ,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IACE,CAAC,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAC3C,iBAAiB,KAAK,MAAM;YAC5B,kBAAkB,CAAC,iBAAiB,CAAC,KAAK,SAAS,EACnD,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,wBAAwB,EACxB,8DAA8D,EAC9D,WAAW,CACZ,CACF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QAC3C,MAAM,iBAAiB,GAAsC,EAAE,CAAC;QAChE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,wCAAwC,EACxC,WAAW,CACZ,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CACjE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,EAAE,KAAK,CAAC,CAC/C,EAAE,CAAC;oBACF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;oBACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAC3B,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,qCAAqC,EACrC,WAAW,CACZ,CACF,CAAC;wBACF,SAAS;oBACX,CAAC;oBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBAChC,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,mDAAmD,EACnD,WAAW,CACZ,CACF,CAAC;oBACJ,CAAC;oBACD,IACE,CAAC,QAAQ,CAAC,WAAW,CAAC;wBACtB,OAAO,WAAW,CAAC,WAAW,CAAC,KAAK,SAAS,EAC7C,CAAC;wBACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,sCAAsC,EACtC,WAAW,CACZ,CACF,CAAC;oBACJ,CAAC;oBACD,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,IACE,IAAI,KAAK,SAAS;YAClB,IAAI,KAAK,IAAI;YACb,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,EACvE,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,2DAA2D,EAC3D,WAAW,CACZ,CACF,CAAC;QACJ,CAAC;QACD,MAAM,kBAAkB,GACtB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,IAAI,CAAC,MAAM,GAAG,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC;QAC/C,MAAM,WAAW,GACf,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAC7C,kBAAkB;YAClB,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3E,MAAM,iBAAiB,GAAG,yBAAyB,CACjD,KAAK,EACL,iBAAiB,EACjB,YAAY,CACb,CAAC;QACF,IACE,CAAC,SAAS,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAClE,iBAAiB,CAClB;YACD,iBAAiB,KAAK,SAAS,EAC/B,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,oEAAoE,EACpE,WAAW,CACZ,CACF,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,IAAI,CAAC;YACb,iBAAiB;YACjB,SAAS,EAAE,iBAAiB,IAAI,iBAAiB,CAAC,GAAG,CAAC;YACtD,SAAS,EAAE,kBAAkB,CAAC,iBAAiB,CAAC;YAChD,iBAAiB;YACjB,WAAW;YACX,mBAAmB,EAAE,SAAS;YAC9B,YAAY;YACZ,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IACD,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,SAAS,SAAS,QAAQ,CAAC,YAAY,EAAE,CAAC;QAClE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAC1C,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,WAAW;YAAE,SAAS;QACpC,MAAM,QAAQ,GACZ,oBAAoB,CAAC,GAAG,CACtB,GAAG,QAAQ,CAAC,SAAS,SAAS,QAAQ,CAAC,YAAY,EAAE,CACtD,IAAI,EAAE,CAAC;QACV,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACxD,IAAI,WAAW,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,mBAAmB;gBAC1B,WAAW,GAAG,WAAW;oBACvB,CAAC,CAAC,sBAAsB;oBACxB,CAAC,CAAC,sBAAsB,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,qBAAqB,EACrB,iEAAiE,CAClE,CACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC/B,kBAAkB,EAAE,kBAAkB;QACtC,QAAQ;QACR,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC;QACrD,aAAa,EAAE,+CAAoC;QACnD,cAAc,EAAE,kCAAkC;QAClD,qBAAqB,EAAE,0BAA0B;QACjD,IAAI,EAAE;YACJ,IAAI,EAAE,6BAAkB;YACxB,OAAO,EAAE,gCAAqB;SAC/B;KACF,CAAC;AACJ,CAAC"}

package/src/infrastructure-change/plan.d.ts

@@ -20,9 +20,21 @@ export interface CreateInfrastructurePlanInputV1 {
     versions: Readonly<Record<string, string>>;
 }
 /**
- * Hashes the material plan contract. generatedAt, expiresAt, repository,
- * sourceCommit, and approval-record contents are intentionally excluded and
- * validated independently immediately before apply.
+ * Returns the value-free resource projection used by plan and drift digests.
+ * SST's BucketFiles dynamic provider reports rebuilt file arrays by ephemeral
+ * list index. The committed source and release-candidate authorities bind the
+ * bytes; the plan binds the mutation kind without turning array scheduling
+ * into a new approval identity. Every unrecognized path remains exact.
+ *
+ * @internal
+ */
+export declare function materialNormalizedSstDiffResources(diff: NormalizedSstDiffV1): readonly unknown[];
+/**
+ * Hashes the material plan contract. Diagnostic source positions, observation
+ * timestamps, generatedAt, expiresAt, repository, sourceCommit, and
+ * approval-record contents are intentionally excluded. Freshness, repository,
+ * source, and approval authority are validated independently immediately
+ * before apply.
  */
 export declare function computeMaterialPlanDigest(plan: Omit<InfrastructurePlanV1, 'materialDigest'> | InfrastructurePlanV1): string;
 export declare function createInfrastructurePlan(input: CreateInfrastructurePlanInputV1): InfrastructurePlanV1;
@@ -38,3 +50,18 @@ export declare function validateInfrastructurePlanForApply(input: {
     recomputed: InfrastructurePlanV1;
     sourceChangesSincePlan: readonly string[];
 }): InfrastructurePlanValidationV1;
+/**
+ * Validates a fresh protected-workflow plan against source-bound deployment
+ * authority. The retained provider preview remains review evidence, but
+ * provider observations are not treated as a replayable transaction. Every
+ * approval-required resource and operation in the fresh plan must have been
+ * present in the reviewed plan.
+ */
+export declare function validateInfrastructurePlanForProtectedApply(input: {
+    approval?: InfrastructureApprovalRecordV1;
+    environmentReviewerApproved?: boolean;
+    now: string;
+    planned: InfrastructurePlanV1;
+    recomputed: InfrastructurePlanV1;
+    sourceChangesSincePlan: readonly string[];
+}): InfrastructurePlanValidationV1;